Reviewers: Vyacheslav Egorov,
Message:
This is ia32 only.
Description:
Fix lazy deoptimization at HInvokeFunction and enable target-recording
call-function stub.
Changes the way we do lazy deoptimization:
1. For side-effect instructions, we insert the lazy-deopt call at
the following LLazyBailout instruction.
CALL
GAP
LAZY-BAILOUT ==> lazy-deopt-call
2. For other instructions (StackCheck) we insert it right after the
instruction since the deopt targets an earlier deoptimization environment.
STACK-CHECK
GAP ==> lazy-deopt-call
The pc of the lazy-deopt call that will be patched in is recorded in the
deoptimization input data. Each Lithium instruction can have 0..n
safepoints.
All safepoints get the deoptimization index of the associated LAZY-BAILOUT
instruction. On lazy deoptimization we use the return-pc to find the
safepoint.
The safepoint tells us the deoptimization index, which in turn finds us the
PC where to insert the lazy-deopt-call.
Additional changes:
* RegExpLiteral marked it as having side-effects so that it
gets an explicitlazy-bailout instruction (instead of
treating it specially like stack-checks)
* Enable target recording CallFunctionStub to achieve
more inlining on optimized code.
BUG=v8:1789
TEST=jslint and uglify run without crashing,
mjsunit/compiler/regress-lazy-deopt.js
Please review this at http://codereview.chromium.org/8492004/
SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/
Affected files:
M src/deoptimizer.cc
M src/hydrogen-instructions.h
M src/ia32/deoptimizer-ia32.cc
M src/ia32/full-codegen-ia32.cc
M src/ia32/lithium-codegen-ia32.h
M src/ia32/lithium-codegen-ia32.cc
M src/ia32/lithium-ia32.h
M src/lithium.h
M src/objects.h
M src/safepoint-table.h
M src/safepoint-table.cc
M test/mjsunit/compiler/regress-funcaller.js
A test/mjsunit/compiler/regress-lazy-deopt.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
